Privacy

Awaiting outside review · 27 August 2026. A checkbox is not a lawyer. Counsel has not signed plate-to-VIN, DPPA, live charges, or a courtroom venue.

1. 01 · Privacy

   No accounts

   There is no sign-up, no password, and no profile. We cannot look you up, because there is nothing on our side to look up. Every desk in this bay opens cold.

2. 02 · Privacy

   What stays in this browser

   These are written by your own browser under keys that start with openhood. — that is your device's storage, not a server of ours:

   • The vehicle you identified — VIN, year, make, model, mileage.
   • The ZIP or city you searched for rooftops.
   • Your last quote and the quote history behind it.
   • Your service log, build notes, and trust checklist.

3. 03 · Privacy

   What leaves this browser

   To print a real spec card we have to ask the agencies that hold the data. Three requests leave, and only these three:

   Those are public government and volunteer services. Each one sees the request and, like any web server, the network address it came from. We do not attach your name — we do not have your name.

   • VIN, or year / make / model → NHTSA vPIC and NHTSA SaferCar, for the decode, recalls, complaints, and crash ratings.
   • Year / make / model → EPA FuelEconomy.gov, for the mileage numbers.
   • ZIP or city → OpenStreetMap Nominatim to become coordinates, then Overpass to find nearby rooftops.

4. 04 · Privacy

   Photos

   A VIN plate or estimate photo is resized and compressed by your own phone first, before anything moves. Reading it on the device stays on the device.

   Cloud photo reading exists only if the operator running this bay turned on the optional photo connection. With that connection on, one compressed image goes to OpenAI to be read and the page tells you which path it took. Without it, nothing uploads and the page says so instead of pretending it read the photo.

5. 05 · Privacy

   The RO window

   If you send the contact form, we get what you typed: a name, a phone or an email, the ticket, and any photo you attached. We use it to answer you. We do not sell it, list it, or route it to a shop.

   Where the operator set mail keys, that ticket goes to a desk mailbox. Where they did not, it is written to a file on the machine running this bay and the page stamps it “local” instead of claiming an email went out.

6. 06 · Privacy

   We do not sell personal information

   We have never sold, rented, or traded personal information, and we are not building toward it. There is no shop network to sell you into, no lead auction, and no cut of a repair coming back to us.

   There are no advertising pixels and no sale of personal information. We do not build a shop-lead profile of your car or your ZIP.

   Optional Google Analytics 4 loads only when the operator set NEXT_PUBLIC_GA_ID to a real G- property. Unset means no analytics script. This page does not invent a measurement ID.

7. 07 · Privacy

   The offline cache

   If your browser installs our service worker, it stores an offline card, the icons, and the app manifest so the bay still opens in a dead parking garage. It does not copy your vehicle, your quote, or your log anywhere.

8. 08 · Privacy

   Children

   This bay is built for people buying, owning, and fixing cars. It is not directed at children under 13, and we do not knowingly collect anything from them.

9. 09 · Privacy

   Your rights, in plain English

   California calls these CCPA rights. We give the same answer to everyone, in every state:

   Know what we hold. For nearly everyone: nothing. Your vehicle, ZIP, quote, and log are in your browser, not our records.

   Get a copy. It is already on your device. The service log and findings desks export it as a file you keep.

   Delete it. Clear this site's data in your browser settings and it is gone. If you sent something through the RO window, write to us and we delete that ticket.

   Opt out of a sale. There is nothing to opt out of. We do not sell or share personal information for money or for advertising.

   No retaliation. Every desk here is free whether you write to us or never do.

10. 10 · Privacy

    Who else is in the loop

    NHTSA, the EPA, and OpenStreetMap (Nominatim and Overpass) on every visit that needs them. OpenAI only when a photo key is set. A mail provider only when the RO window has mail keys. Each of those has its own privacy terms.

    Optional keys for paid data — extra rooftops, plate lookups, listings — sit dark unless the operator turns them on, and the desk stamps when a key is off. Google Analytics is the same rule: no NEXT_PUBLIC_GA_ID, no tracker. We do not run live plate-to-VIN, escrow, or a store app here.

11. 11 · Privacy

    Changes to this page

    The effective date at the top moves when this page changes, and a material change gets its own line. There is no mailing list to notify you, so check the date.